Threshold-based distributed DDoS attack detection in ISP networks

Abstract

The purpose of this paper is to propose a more efficient and accurate distributed denial of service (DDoS)attack detection mechanism that detects DDoS attacks by monitoring the incoming traffic on the edge routers of ISPnetworks. It can be implemented as a module or agent function on the machine that is responsible for processing routertraffic. The detection algorithm works by monitoring the traffic passing through the edge routers and identifying theoccurrence of DDoS attacks or flash events. The algorithm calculates different values like the normalized router entropy,packet rate, and entropy rate and compares them against the preidentified threshold values to detect the happening of aDDoS attack or flash event. The threshold values used in the algorithm are evaluated offline by taking the sample attackand the legitimate traffic flows. The proposed detection mechanism can be implemented on the edge routers of the ISPnetworks. ISPs are selected for the deployment of attack detection because the customer networks are directly connectedwith them. The effectiveness of the algorithms can be validated mathematically using a sample test bed containingrealistic internet topology. The results clearly indicate that the proposed detection mechanism does effective detectionwith a high detection rate and fewer false positives.